-
Notifications
You must be signed in to change notification settings - Fork 182
fix: configmap generation with no-config mode for external secret management
#402
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
tuunit
wants to merge
3
commits into
main
Choose a base branch
from
fix/configmap-generation
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
23 changes: 23 additions & 0 deletions
23
helm/oauth2-proxy/ci/alphaconfig-7-existing-secret-values.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| # Test Case 7: alphaConfig enabled + existingSecret | ||
| # Expected: Chart mounts the external alpha Secret instead of generating one. | ||
|
|
||
| alphaConfig: | ||
| enabled: true | ||
| existingSecret: my-external-alpha-secret | ||
|
|
||
| extraObjects: | ||
| - apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: my-external-alpha-secret | ||
| type: Opaque | ||
| stringData: | ||
| oauth2_proxy.yml: | | ||
| --- | ||
| server: | ||
| BindAddress: 0.0.0.0:4180 | ||
| providers: | ||
| - id: google | ||
| provider: google | ||
| clientID: fake-client-id | ||
| clientSecret: fake-client-secret |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -163,37 +163,73 @@ metricsServer: | |
| {{- end }} | ||
| {{- end -}} | ||
|
|
||
| {{- define "oauth2-proxy.alpha-config.source" -}} | ||
| {{- if not .Values.alphaConfig.enabled -}} | ||
| disabled | ||
| {{- else if .Values.alphaConfig.existingConfig -}} | ||
| existing-configmap | ||
| {{- else if .Values.alphaConfig.existingSecret -}} | ||
| existing-secret | ||
| {{- else -}} | ||
| generated | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{- define "oauth2-proxy.alpha-config.name" -}} | ||
| {{- $source := include "oauth2-proxy.alpha-config.source" . -}} | ||
| {{- if eq $source "existing-configmap" -}} | ||
| {{- .Values.alphaConfig.existingConfig -}} | ||
| {{- else if eq $source "existing-secret" -}} | ||
| {{- .Values.alphaConfig.existingSecret -}} | ||
| {{- else if eq $source "generated" -}} | ||
| {{- printf "%s-alpha" (include "oauth2-proxy.fullname" .) -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| If `config.forceLegacyConfig=false`, the chart ignores both the `config.configFile` and `config.existingConfig` overrides and only generates a minimal necessary legacy config. | ||
| If `config.existingConfig` is set and `config.forceLegacyConfig=true`, the external ConfigMap is mounted into the mounted file. | ||
| If `config.configFile` is set and `config.forceLegacyConfig=true`, the chart renders that inline content into the mounted file. | ||
| If `config.forceLegacyConfig=false` and `alphaConfig.enabled=false`, the chart renders no config map and does not mount a file. | ||
| */}} | ||
|
Comment on lines
189
to
194
|
||
| {{- define "oauth2-proxy.legacy-config.mode" -}} | ||
| {{- if and .Values.alphaConfig.enabled (not .Values.config.forceLegacyConfig) -}} | ||
| {{- define "oauth2-proxy.legacy-config.source" -}} | ||
| {{- if .Values.alphaConfig.enabled -}} | ||
| {{- if not .Values.config.forceLegacyConfig -}} | ||
| generated-alpha-compatible | ||
| {{- else if .Values.config.existingConfig -}} | ||
| existing-configmap | ||
| {{- else if .Values.config.configFile -}} | ||
| inline-custom | ||
| {{- else if .Values.alphaConfig.enabled -}} | ||
| {{- else -}} | ||
| generated-alpha-compatible | ||
| {{- end -}} | ||
| {{- else if not .Values.config.forceLegacyConfig -}} | ||
| no-config | ||
| {{- else if .Values.config.existingConfig -}} | ||
|
Comment on lines
+203
to
+208
|
||
| existing-configmap | ||
| {{- else if .Values.config.configFile -}} | ||
| inline-custom | ||
| {{- else -}} | ||
| generated-legacy | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{- define "oauth2-proxy.legacy-config.enabled" -}} | ||
| {{- ne (include "oauth2-proxy.legacy-config.source" .) "no-config" -}} | ||
| {{- end -}} | ||
|
|
||
| {{- define "oauth2-proxy.legacy-config.name" -}} | ||
| {{- if eq (include "oauth2-proxy.legacy-config.mode" .) "existing-configmap" -}} | ||
| {{- if eq (include "oauth2-proxy.legacy-config.source" .) "existing-configmap" -}} | ||
| {{- .Values.config.existingConfig -}} | ||
| {{- else -}} | ||
| {{- template "oauth2-proxy.fullname" . -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{- define "oauth2-proxy.legacy-config.content" -}} | ||
| {{- if eq (include "oauth2-proxy.legacy-config.mode" .) "inline-custom" -}} | ||
| {{- if eq (include "oauth2-proxy.legacy-config.source" .) "inline-custom" -}} | ||
| {{- tpl .Values.config.configFile $ -}} | ||
| {{- else if eq (include "oauth2-proxy.legacy-config.mode" .) "generated-alpha-compatible" -}} | ||
| {{- else if eq (include "oauth2-proxy.legacy-config.source" .) "generated-alpha-compatible" -}} | ||
| email_domains = {{ .Values.config.emailDomains | toJson }} | ||
| {{- else -}} | ||
| email_domains = {{ .Values.config.emailDomains | toJson }} | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,5 @@ | ||
| {{- if ne (include "oauth2-proxy.legacy-config.mode" .) "existing-configmap" }} | ||
| {{- $legacySource := include "oauth2-proxy.legacy-config.source" . }} | ||
| {{- if not (has $legacySource (list "existing-configmap" "no-config")) }} | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
|
Comment on lines
+1
to
4
|
||
| metadata: | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,6 @@ | ||
| {{- $legacySource := include "oauth2-proxy.legacy-config.source" . }} | ||
| {{- $legacyConfigEnabled := eq (include "oauth2-proxy.legacy-config.enabled" .) "true" -}} | ||
| {{- $alphaConfigSource := include "oauth2-proxy.alpha-config.source" . -}} | ||
| {{- $redisEnabled := eq (include "oauth2-proxy.redis.enabled" .) "true" -}} | ||
| {{- $redisValues := index .Values "redis-ha" | default dict -}} | ||
| apiVersion: apps/v1 | ||
|
|
@@ -27,12 +30,14 @@ spec: | |
| template: | ||
| metadata: | ||
| annotations: | ||
| {{- if ne (include "oauth2-proxy.legacy-config.mode" .) "existing-configmap" }} | ||
| {{- if and $legacyConfigEnabled (ne $legacySource "existing-configmap") }} | ||
| checksum/config: {{ include "oauth2-proxy.legacy-config.content" . | sha256sum }} | ||
| {{- end }} | ||
| {{- if .Values.alphaConfig.enabled }} | ||
| {{- if eq $alphaConfigSource "generated" }} | ||
| checksum/alpha-config: {{ include "oauth2-proxy.alpha-config" . | sha256sum }} | ||
| {{- end }} | ||
| legacy/source: {{ include "oauth2-proxy.legacy-config.source" . }} | ||
| alpha/source: {{ include "oauth2-proxy.alpha-config.source" . }} | ||
| {{- if .Values.authenticatedEmailsFile.enabled }} | ||
| checksum/config-emails: {{ include (print $.Template.BasePath "/configmap-authenticated-emails-file.yaml") . | sha256sum }} | ||
| {{- end }} | ||
|
|
@@ -145,7 +150,9 @@ spec: | |
| {{- toYaml . | nindent 10 }} | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- if $legacyConfigEnabled }} | ||
| - --config=/etc/oauth2_proxy/oauth2_proxy.cfg | ||
| {{- end }} | ||
|
Comment on lines
+153
to
+155
|
||
| {{- if .Values.authenticatedEmailsFile.enabled }} | ||
| {{- if .Values.authenticatedEmailsFile.template }} | ||
| - --authenticated-emails-file=/etc/oauth2-proxy/{{ .Values.authenticatedEmailsFile.template }} | ||
|
|
@@ -302,10 +309,12 @@ spec: | |
| readOnly: true | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- if $legacyConfigEnabled }} | ||
| - mountPath: /etc/oauth2_proxy/oauth2_proxy.cfg | ||
| name: configmain | ||
| subPath: oauth2_proxy.cfg | ||
| {{- if .Values.alphaConfig.enabled }} | ||
| {{- end }} | ||
| {{- if ne $alphaConfigSource "disabled" }} | ||
| - mountPath: /etc/oauth2_proxy/oauth2_proxy.yml | ||
| name: configalpha | ||
| subPath: oauth2_proxy.yml | ||
|
|
@@ -368,23 +377,23 @@ spec: | |
| name: {{ template "oauth2-proxy.fullname" . }}-wait-for-redis | ||
| defaultMode: 0775 | ||
| {{- end }} | ||
| {{- if $legacyConfigEnabled }} | ||
| - configMap: | ||
| defaultMode: 420 | ||
| name: {{ include "oauth2-proxy.legacy-config.name" . | trim }} | ||
| name: configmain | ||
| {{- if .Values.alphaConfig.enabled }} | ||
| {{- if .Values.alphaConfig.existingConfig }} | ||
| {{- end }} | ||
| {{- if eq $alphaConfigSource "existing-configmap" }} | ||
| - configMap: | ||
| defaultMode: 420 | ||
| name: {{ .Values.alphaConfig.existingConfig }} | ||
| name: {{ include "oauth2-proxy.alpha-config.name" . }} | ||
| name: configalpha | ||
| {{- else }} | ||
| {{- else if or (eq $alphaConfigSource "existing-secret") (eq $alphaConfigSource "generated") }} | ||
| - secret: | ||
| defaultMode: 420 | ||
| secretName: {{ if .Values.alphaConfig.existingSecret }}{{ .Values.alphaConfig.existingSecret }}{{ else }}{{ template "oauth2-proxy.fullname" . }}-alpha{{ end }} | ||
| secretName: {{ include "oauth2-proxy.alpha-config.name" . }} | ||
| name: configalpha | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- if ne (len .Values.extraVolumes) 0 }} | ||
| {{ tpl (toYaml .Values.extraVolumes) . | indent 6 }} | ||
| {{- end }} | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
|
|
@@ -64,6 +64,8 @@ config: | |||||||
| # generates a minimal legacy config from emailDomains only. | ||||||||
| # 3. If configFile is empty/not set, the config is auto-generated | ||||||||
| # from emailDomains and, when alphaConfig is disabled, upstreams. | ||||||||
| # 4. When alphaConfig.enabled=false and forceLegacyConfig=false | ||||||||
| # no ConfigMap is generated and mounted | ||||||||
| configFile: "" | ||||||||
| # Email domains allowed to authenticate when the chart generates | ||||||||
| # the main oauth2_proxy.cfg. | ||||||||
|
|
@@ -109,6 +111,8 @@ config: | |||||||
| # instead (see examples below). | ||||||||
| # - Move any other relevant settings into alphaConfig and/or | ||||||||
| # flags rather than relying on a custom legacy configFile. | ||||||||
| # 3) If forceLegacyConfig and alphaConfig.enabled are false | ||||||||
| # no ConfigMap is being mounted. | ||||||||
| forceLegacyConfig: true | ||||||||
| # | ||||||||
| # Custom configuration file: oauth2_proxy.cfg (overrides | ||||||||
|
|
@@ -164,10 +168,16 @@ alphaConfig: | |||||||
| # | ||||||||
| # Arbitrary configuration to append | ||||||||
| # This is treated as a Go template and rendered with the root context | ||||||||
| # This may be combined with configData/serverConfigData/metricsConfigData | ||||||||
| # when the chart generates the alpha config itself. | ||||||||
| configFile: "" | ||||||||
| # Use an existing config map (see secret-alpha.yaml for required fields) | ||||||||
| # Use an existing config map (see secret-alpha.yaml for required fields). | ||||||||
|
||||||||
| # Use an existing config map (see secret-alpha.yaml for required fields). | |
| # Use an existing ConfigMap containing the alpha config file (for example, | |
| # with a key like `oauth2_proxy.yml` under `.data`). |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This line references
forceLegacyConfigwithout theconfig.prefix. Since the value isconfig.forceLegacyConfig, the current wording is ambiguous and could confuse readers; please change it toconfig.forceLegacyConfigfor consistency with the rest of the document.